diff --git a/tools/create-platform-audit-bucket.sh b/tools/create-platform-audit-bucket.sh
index 50ca36f..7fdb44a 100755
--- a/tools/create-platform-audit-bucket.sh
+++ b/tools/create-platform-audit-bucket.sh
@@ -41,10 +41,15 @@ fi
 eval "$(BOOTSTRAP_JSON="$BOOTSTRAP_JSON" python3 - <<'PY'
 import json, os, sys
 data = json.loads(os.environ["BOOTSTRAP_JSON"])
-missing = [k for k in ("ACCESS_KEY", "SECRET_KEY", "DEFAULT_ORGANIZATION_ID", "DEFAULT_PROJECT_ID") if not (data.get(k) or data.get(k.lower()))]
+needed = ("ACCESS_KEY", "SECRET_KEY", "DEFAULT_ORGANIZATION_ID", "DEFAULT_PROJECT_ID")
+missing = [k for k in needed if not (data.get(k) or data.get(k.lower()))]
 if missing:
     sys.stderr.write("bootstrap fields missing: " + ",".join(missing) + "\n")
     sys.exit(4)
+placeholders = [k for k in needed if (data.get(k) or data.get(k.lower()) or "") in {"xxx", "redacted", "changeme"}]
+if placeholders:
+    sys.stderr.write("bootstrap still has example placeholders; replace them in the OpenBao UI first\n")
+    sys.exit(5)
 def g(k):
     return data.get(k) or data.get(k.lower())
 print("export SCW_ACCESS_KEY=" + json.dumps(g("ACCESS_KEY")))